GitHub Advisoryadvisory · npm

GHSA-gfjr-3jmm-4g9v Symlink Arbitrary File Overwrite in tar

HIGH Published 2017-10-24 Modified 2021-09-10 Official page ↗
Aliases
CVE-2015-8860
Ecosystem
npm
Packages
tar
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-59
Reviewed
2020-06-16

Affected packages

• npm tar: < 2.0.0 → fixed in 2.0.0

Description

Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory. Recommendation Update to version 2.0.0 or later

Related

Alias · CVE (1)

  • CVE-2015-8860 The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References